Security

Our approach to security

Protecting customer and guest data is a core requirement of the platform. We apply layered controls across infrastructure, application code and operations.

Technical measures

Encryption

• All connections are protected with TLS 1.2+.
• AI provider API keys and messenger tokens are stored encrypted at rest.
• User passwords are hashed with bcrypt.

Authentication and authorisation

• Role-based access control (super-admin / restaurant staff / guest).
• Strict tenant isolation: every restaurant's data is scoped at the application layer, and panel queries cannot cross tenants.
• CSRF protection on all forms; output escaping against XSS, including the embeddable widget.
• Rate limiting on public API endpoints and AI-assisted features.

Operations

• Regular automated database backups.
• Availability and anomaly monitoring.
• Dependency updates and security patches applied promptly after publication.
• Configurable retention and automatic pruning of chat logs.

Responsible disclosure

If you discover a vulnerability, please report it privately before any public disclosure. We commit to:

• acknowledging your report within 48 hours;
• providing progress updates within 7 days;
• crediting researchers (if desired) after the fix is released.

Report to: [email protected]

Please do not run destructive tests (DoS, data deletion) and do not access other customers' data.

Compliance

• Personal data is processed in accordance with the GDPR and the Law of Ukraine «On Personal Data Protection».
• Payment card data is handled entirely by our payment partner Paddle (PCI DSS compliant); we never store card numbers.
• Data is not shared with third parties except as described in the Privacy Policy.

Last updated: 12 June 2026